Feds get 3 days to patch Ray RCE flaw

Federal agencies have just three days to patch a critical Ray vulnerability that attackers are already exploiting, according to a new directive from the Cybersecurity and Infrastructure Security Agency (CISA). The agency's unusual urgency signals that the bug, which can give attackers a foothold in private corporate networks, is being actively used in the wild.

A Critical Flaw Reaches Feds

Tracked as CVE-2025-62593 and rated 9.4 under CVSS v4, the vulnerability was first disclosed in November 2025. It allows an attacker to use Firefox or Safari to achieve remote code execution (RCE) on a vulnerable Ray system. Ray is a widely used open source framework for scaling Python and machine-learning workloads, and it is used and supported by major tech companies including Amazon, Apple, and OpenAI.

The bug stems from how vulnerable Ray versions try to identify and block browser requests. They check whether the User-Agent header begins with "Mozilla." However, Firefox and Safari allow scripts using the Fetch API to modify that header, enabling the attack.

Exploitation via Malicious Ads

A developer running Ray could trigger the exploit simply by visiting a dodgy website or receiving a malicious ad in an affected browser. The attacker can then use DNS rebinding to reach the local Ray service.

"This vulnerability impacts developers running development/testing environments with Ray," the project's developers explained. "If they fall victim to a phishing attack, or are served a malicious ad, they can be exploited, and arbitrary shell code can be executed on their developer machine."

— Ray developers, via security advisory

But the impact doesn't stop at the individual developer's machine. "This attack can also be leveraged to attack network-adjacent instances of Ray by leveraging the browser as a confused deputy intermediary to attack Ray instances running inside a private corporate network," the developers added.

Three-Day Remediation Deadline

Ray 2.52.0 fixes the flaw. CISA gave US federal civilian executive branch agencies three days to remediate it, rather than the standard 14. CISA did not explain the urgency, and marked the catalog's "known to be used in ransomware campaigns" field as "unknown." However, Binding Operational Directive 26-04 allows the agency to impose a three-day remediation window on vulnerabilities it considers especially risky.

Ray's Growth and Reach

Ray is an open source framework that helps developers scale Python and machine-learning workloads from a local environment to a cluster with minimal code changes. Now managed by the Linux Foundation's PyTorch Foundation, the project started at UC Berkeley and was commercialized via Anyscale, the startup founded by Ray's developers in 2019.

According to Anyscale's figures as of October 2025, Ray had more than 237 million total downloads, and 7 million per week – representing a near-tenfold growth year-on-year. Product analysis site NextSprints estimates that Ray has 1 million monthly active users and is used by 60 percent of Fortune 500 companies.

Why the Vulnerability Exists

The security advisory blamed Ray's longstanding lack of authentication on critical endpoints for making the attack possible. Ray's security model historically assumed that clusters would run inside a trusted, isolated network, leaving authentication and access control to the surrounding infrastructure.

Ray 2.52.0 introduced optional token-based authentication as an additional defense against unauthorized access, although it remains disabled by default. The project continues to recommend deploying clusters inside a controlled network rather than treating authentication as a substitute for isolation.

What This Means for You

The three-day deadline is a clear signal that CISA considers this bug an immediate threat, not just to federal networks but potentially to any organization using Ray. For enterprises that rely on Ray for AI and machine learning workloads, the message is stark: if you haven't patched to version 2.52.0, you should assume you're a target. The exploitation of this flaw through phishing and malvertising means that even developers who never touch Ray directly could be the entry point into a corporate network. This directive should prompt a swift review of all Ray deployments, not just those in government, and a reminder that the framework's default trust model is no longer sufficient in today's threat environment.